Need help parsing Venafi logs

[miuwang]

We are feeding Venafi logs into Splunk and have trouble with records breaking at the wrong places.

This is the format of the input - all log records start with this:
10.213.32.41,4/16/2018 11:06 AM,0001001D,...
IP date time 8 hex-character event ID

and can have multiple lines per record.

Can someone suggest sourcetype configuration to correctly parse our logs?

[somesoni2]

Try this (props.conf on your indexer/heavy forwarder)

[Venafi_Logs]
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)(?=\d{1.3}\.\d{1.3}\.\d{1.3}\.\d{1.3},\d+\/\d+\/\d+\s\d+\:\d+)
TIME_PREFIX = ^\d{1.3}\.\d{1.3}\.\d{1.3}\.\d{1.3},
TIME_FORMAT = %m/%d/%Y %H:%M %p
MAX_TIMESTAMP_LOOKAHEAD = 19